Internal IT resources have vital roles in maintaining core institutional operations, and diverting such resources risks business disruption.

The best computer forensics experts are able to communicate highly technical concepts in a manner easily understandable to finders of fact, which is not a core function for IT personnel.

If something goes wrong, you have much stronger argument that you acted reasonably if you retained a reputable expert, and it will be much harder for the other side to argue the mistake in fact was deliberate.